MALICIOUS — bb880735977e50ed858663b43e469f6d6141f17a5edf61cb057d04fb9990db61

MALICIOUS — bb880735977e50ed858663b43e469f6d6141f17a5edf61cb057d04fb9990db61 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Aenjaris family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: bb880735977e50ed858663b43e469f6d6141f17a5edf61cb057d04fb9990db61
• SHA-1: 6154746d6c12b8c85a46d7a0c1eee718ffcdfd53
• MD5: 346a2d0cfe4e5e8e2e8e4444c5bc2e8a
• imphash: 8c235e3a9d7f61224225c532f7c9583a
• ssdeep: 3072:jA2Id2C+3/Xt1q3r4AJtFCP3NJspcs6S+W5Q6+SMZeYR604pLthEjQT65:jlf+rjvA3NmGn5Ze460kEjP
• TLSH: T108428E89A63A6A48C939C9621F9173CDE443386550BD6B0D97A7B13A0BD30EFB47041F
• Submitted as: bb880735977e50ed858663b43e469f6d6141f17a5edf61cb057d04fb9990db61
• File type: pe · Size: 213486 bytes
• Verdict: malicious (100/100) · Family: Aenjaris

Detections (6 of 56 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Razy-9759519-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
• Emsisoft (Emergency Kit): Gen:Variant.Ransom.Babuk.69
• Kaspersky (KVRT): Trojan.Win32.Nobady.gen

MITRE ATT&CK

• T1547.001
• T1056.001
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Babuk.69 (rule Gen:Variant.Ransom.Babuk.69) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Nobady.gen (rule Trojan.Win32.Nobady.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

8972 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• wpad
• ye.c.lencr.org
• yr.c.lencr.org
• v10.events.data.microsoft.com
• 195.25.217.172.in-addr.arpa.
• 107.238.33.23.in-addr.arpa.
• watson.events.data.microsoft.com
• 85.65.42.20.in-addr.arpa.
• 166.142.190.20.in-addr.arpa.
• 221.45.233.135.in-addr.arpa.
• 224.0.0.251
• ff02:0:0:0:0:0:0:fb
• ff02:0:0:0:0:0:1:3
• 224.0.0.252
• 10.240.0.76
• fe80:0:0:0:b8e6:2594:124c:1d1d
• 23.221.133.54

Embedded domains

• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.42.65.85
• 135.233.45.221

File paths

• f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
• C:\windows\%s
• C:\windows\system32\%s
• C:\windows\system\%s
• c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report